Developing AI guidelines

This article is part of our “Simple Security Mistakes That Cause Real Problems for Morgantown Businesses” series, where we break down the everyday security gaps we see affecting businesses across North Central West Virginia—and how to fix them without over-complicating things.

********

The proposal looked great. Polished. Professional. Exactly the kind of document that makes a business look like it has everything under control.

Then the client called.

The market research in section two—the numbers that supported the entire recommendation—didn’t exist. The AI made them up.

Not vaguely. Not accidentally. Confidently. In detail.

There’s a name for this. It’s called a hallucination.

And it tends to happen when a capable, helpful tool is given access to real work—with no structure around how it’s used.

If you’re running a business in Morgantown or anywhere across North Central West Virginia, this probably isn’t as far off as it sounds. We’re starting to see versions of this show up more often.

The Intern Nobody Onboarded

Imagine hiring an intern and giving them access to everything on day one:

  • Client files
  • Email drafts
  • Financial reports
  • Internal documents

And then saying:

“Just jump in and figure it out.”

No guidance. No boundaries. No check-ins. That’s how a lot of businesses are adopting AI right now. Not because they’re being careless. Because the tools are:

  • Easy to use
  • Built into everyday software
  • Actually helpful

There’s an AI button in your email. Another in your documents. Another in your project tools. It feels like help has arrived. And in many ways, it has. But like anything else in your business, it works best when there’s a little structure behind it.

What We’re Seeing Around Here

Across the businesses we work with—construction companies, healthcare and eye care practices, and accounting firms—AI is already being used.

Not formally. Just naturally.

Someone uses it to:

  • Draft an email
  • Summarize notes
  • Clean up a report
  • Organize information

And on the surface, it works well. The issue isn’t that people are using AI. It’s that most teams haven’t stopped to decide:

“How should we actually be using this?”

What Happens Without a Plan

When AI shows up without any guidelines, we tend to see three things.

  1. Information Gets Shared Without Realizing It

Someone pastes:

  • A client contract
  • Financial data
  • Internal notes

…into a tool to get help summarizing or formatting it.

It feels harmless. But many AI tools—especially free or consumer versions—don’t guarantee that information stays private in the way you might expect.

We’re not seeing this because people are careless. We’re seeing it because nobody told them where the line is.

A lot of the same risks show up with basic security habits too—especially when passwords are reused or shared across systems.

Link to our password article: Your Password Is the Key Under the Doormat (Morgantown Business)

 

  1. Tools Start Showing Up That Nobody Approved

This is happening more than most business owners realize.

Employees are using:

  • Free AI tools
  • Browser-based assistants
  • Add-ons inside other platforms

Without anyone really tracking:

  • What tools are being used
  • What data they can access
  • Or how that data is handled

From a business standpoint, that creates visibility gaps.

From a security standpoint, it creates risk.

  1. Output Gets Trusted Too Quickly

This is the big one. AI produces clean, confident answers. Even when it’s wrong.

We’ve already seen situations where:

  • Reports include incorrect data
  • Summaries miss key details
  • Content sounds right—but isn’t

And because it looks polished, it doesn’t get questioned. That’s where problems show up.

AI isn’t broken—it’s doing exactly what it’s designed to do. The risk is when there’s no human step before it goes out the door.

The Bigger Issue

AI doesn’t fix messy processes. It speeds them up.

If things are already:

  • Disconnected
  • Unclear
  • Or inconsistent

AI just helps you move faster in that same direction. That’s why this isn’t really a technological issue. It’s an operations issue.

What a Simple Approach Looks Like

Most businesses don’t need a full AI policy. They just need a few clear guardrails.

  1. Decide What Tools Are Okay to Use

Keep a simple list:

  • What’s approved
  • What’s not
  • What’s being tested

This isn’t about control — it’s about awareness.

  1. Add One Review Step

AI drafts. People review.

Nothing goes to:

  • Clients
  • Vendors
  • Public-facing materials

…without someone taking a look first.

That one step prevents most issues.

  1. Set Clear Boundaries on Data

Let your team know:

What should never go into AI tools:

  • Client information
  • Financial data
  • Employee details
  • Contracts

If people know the boundaries, they’ll follow them. If they don’t, they’ll guess.

What We See With Most Businesses

Most teams fall into one of three groups:

  1. Not using AI yet
  2. Using it informally, without structure
  3. Starting to realize they need some guardrails

None of those are wrong. It just depends on whether someone has taken the time to step back and define how it should fit into the business.

And for newer employees especially, unclear processes combined with tools like AI can create even more opportunities for mistakes early on.

Link to our new hire article: The First Week Mistake Nobody Plans For In Morgantown Businesses

 

Let’s Keep It Simple

If your team is already using AI—and most are at this point—it’s worth taking a few minutes to make sure it’s helping without creating unintended problems.

If you’re a business owner in Morgantown or the surrounding area, we’re happy to talk through what that could look like in a practical way.

No hype. No complicated policies.

Just a straightforward conversation about:

  • What’s actually happening
  • What makes sense to put in place
  • And how to keep things simple moving forward

Call us at 304-296-8026 or book a quick discovery call.

And if you know another business owner around here who’s started using AI without really thinking through how it should be used, feel free to pass this along.

Because the businesses that run into trouble with AI won’t be the ones using it. They’ll be the ones who never decided how it should be used.

********

Part of Our Security Series for Morgantown Businesses

This article is part of our “Simple Security Mistakes That Cause Real Problems for Morgantown Businesses” series.

If this topic hit close to home, you may also want to take a look at:

Most businesses we talk to are dealing with more than one of these—it just shows up in different ways.